A complete solution to package and build a ready for distribution Electron app with “auto update” support out of the box
This report presents the forensic synthetic code analysis of electron-userland/electron-builder, a TypeScript project with 14,619 GitHub stars. SynthScan v2.0 examined 161,605 lines of code across 744 source files, recording 412 pattern matches distributed across 10 syntactic categories. The overall adjusted score of 6.0 places this repository in the Low AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 412 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/vitest-scripts/test-summary.ts | 236 | // ── rendering ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/vitest-scripts/refresh-tests.ts | 11 | // ─── Types ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/vitest-scripts/refresh-tests.ts | 20 | // ─── Platform filter ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/vitest-scripts/refresh-tests.ts | 60 | // ─── Snapshot cleanup ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/vitest-scripts/refresh-tests.ts | 93 | // ─── File list ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/vitest-scripts/refresh-tests.ts | 122 | // ─── CLI ───────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/certInfoTest.ts | 17 | // ─── Test fixture paths ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/certInfoTest.ts | 136 | // ─── Unit tests ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/certInfoTest.ts | 170 | // ─── Additional logic-path tests ───────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/certInfoTest.ts | 195 | // ─── Security: pkcs12PasswordToUtf16 encoding ──────────────────────────────── | COMMENT |
| MEDIUM | test/src/certInfoTest.ts | 222 | // ─── Security: pkcs12PbeDeriveKey key derivation ───────────────────────────── | COMMENT |
| MEDIUM | test/src/certInfoTest.ts | 271 | // ── DoS prevention: iteration count bounds ──────────────────────────────── | COMMENT |
| MEDIUM | test/src/certInfoTest.ts | 317 | // ─── readCertInfo — multiple certificates in one PFX ───────────────────────── | COMMENT |
| MEDIUM | test/src/certInfoTest.ts | 334 | // ─── readCertInfo — legacy PBE error path ──────────────────────────────────── | COMMENT |
| MEDIUM | test/src/certInfoTest.ts | 344 | // ─── readCertInfo — malformed / corrupted input ─────────────────────────────── | COMMENT |
| MEDIUM | test/src/certInfoTest.ts | 364 | // ─── rc2CbcDecrypt — known-answer tests (RFC 2268) ─────────────────────────── | COMMENT |
| MEDIUM | test/src/certInfoTest.ts | 423 | // ─── readCertInfo — RC2-40 encrypted PFX ───────────────────────────────────── | COMMENT |
| MEDIUM | test/src/certInfoTest.ts | 440 | // ─── rc2CbcDecrypt — input validation / security guards ────────────────────── | COMMENT |
| MEDIUM | test/src/certInfoTest.ts | 499 | // ─── pkcs12PbeDeriveKey — salt size guard ──────────────────────────────────── | COMMENT |
| MEDIUM | test/src/cliTest.ts | 6 | // ─── Module mocks (hoisted by vitest above all imports) ─────────────────────── | COMMENT |
| MEDIUM | test/src/cliTest.ts | 41 | // ─── Imports ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/cliTest.ts | 59 | // ─── clearCache ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/cliTest.ts | 152 | // ─── wrap ───────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/cliTest.ts | 208 | // ─── quoteString ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/cliTest.ts | 232 | // ─── Command configuration ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/cliTest.ts | 304 | // ─── CLI entry-point ESM smoke tests ───────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/ksuidTest.ts | 30 | // ─── Unit tests ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/blockmapTest.ts | 190 | // ─── Golden-output suite: JS snapshots + optional binary cross-check ───────── | COMMENT |
| MEDIUM | test/src/extractArchiveTest.ts | 156 | // ─── extractArchive .tar.7z (snap template layout) ──────────────────────────── | COMMENT |
| MEDIUM | test/src/extractArchiveTest.ts | 210 | // ─── isSafeExtractPath ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/extractArchiveTest.ts | 258 | // ─── moveDirAtomic ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/archiveUtilTest.ts | 61 | // ─── compute7zCompressArgs ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/archiveUtilTest.ts | 222 | // ─── archive() — path-level guards (no binary needed) ─────────────────────── | COMMENT |
| MEDIUM | test/src/archiveUtilTest.ts | 245 | // ─── shouldPreserveSymlinks — target platform → -snl policy ────────────────── | COMMENT |
| MEDIUM | test/src/archiveUtilTest.ts | 261 | // ─── archive() — symlink preservation (non-Windows hosts) ──────────────────── | COMMENT |
| MEDIUM | test/src/archiveUtilTest.ts | 324 | // ─── archive() — 7z branch filter (#9983) ──────────────────────────────────── | COMMENT |
| MEDIUM | test/src/archiveUtilTest.ts | 324 | // ─── archive() — 7z branch filter (#9983) ──────────────────────────────────── | COMMENT |
| MEDIUM | test/src/archiveUtilTest.ts | 367 | // ─── buildExcludeArgs (via archive()) — happy-path coverage ─────────────────── | COMMENT |
| MEDIUM | test/src/electronGetTest.ts | 23 | // ─── Test helpers ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/electronGetTest.ts | 66 | // ─── getCacheDirectory ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/electronGetTest.ts | 229 | // ─── Shared temp cache dir for functional tests ─────────────────────────────── | COMMENT |
| MEDIUM | test/src/electronGetTest.ts | 243 | // ─── downloadArtifact: generic artifacts (.tar.gz) ─────────────────────────── | COMMENT |
| MEDIUM | test/src/electronGetTest.ts | 406 | // ─── downloadBuilderToolset: filenameWithExt validation ────────────────────── | COMMENT |
| MEDIUM | test/src/electronGetTest.ts | 422 | // ─── Toolset archive cache (no network) ────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/electronGetTest.ts | 540 | // ─── downloadElectronArtifact: electron platform artifacts (.zip) ──────────── | COMMENT |
| MEDIUM | test/src/electronGetTest.ts | 660 | // ─── downloadElectronArtifact: electron distribution zip (heavy) ────────────── | COMMENT |
| MEDIUM | test/src/electronGetTest.ts | 684 | // ─── Proxy integration ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/updateInfoBuilderTest.ts | 43 | // ── NSIS multi-arch ordering (issue #9745) ────────────────────────────────── | COMMENT |
| MEDIUM | test/src/updateInfoBuilderTest.ts | 43 | // ── NSIS multi-arch ordering (issue #9745) ────────────────────────────────── | COMMENT |
| MEDIUM | test/src/updateInfoBuilderTest.ts | 104 | // ── macOS zip-first behavior (backward compat) ────────────────────────────── | COMMENT |
| MEDIUM | test/src/updateInfoBuilderTest.ts | 126 | // ── Edge cases ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/updateInfoBuilderTest.ts | 226 | // ── createUpdateInfoTasks unit tests ───────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/updateInfoBuilderTest.ts | 285 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/s3BucketLocationTest.ts | 17 | // ─── Mock helper ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/s3BucketLocationTest.ts | 45 | // ─── Unit tests ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/s3BucketLocationTest.ts | 112 | // ─── Credential chain: getBucketLocation forwards resolved credentials ──────── | COMMENT |
| MEDIUM | test/src/s3BucketLocationTest.ts | 148 | // ─── Output-format contract: JS implementation vs app-builder-bin binary ───── | COMMENT |
| MEDIUM | test/src/s3BucketLocationTest.ts | 178 | // ─── Credential resolution unit tests ──────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/iconConverterTest.ts | 99 | // ─── ICNS parser helper ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/src/iconConverterTest.ts | 126 | // ─── ICNS output ───────────────────────────────────────────────────────────── | COMMENT |
| 179 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/vitest-scripts/refresh-tests.ts | 62 | function deleteStaleGeneratedSnapshots(): void { | CODE |
| LOW | …cripts/runtime-tests/generate-toolset-tests-windows.ts | 158 | export function generateWindowsToolsetTests(): void { | CODE |
| LOW | …-scripts/runtime-tests/generate-toolset-tests-linux.ts | 55 | export function generateLinuxToolsetTests(): void { | CODE |
| LOW | test/src/asarIntegrityTest.ts | 22 | async function verifyAsarPerFileIntegrity(expect: ExpectStatic, resourceDir: string) { | CODE |
| LOW | test/src/updater/differentialUpdateLinuxSuite.ts | 11 | export function registerDifferentialLinuxTests(toolset: Required<Pick<ToolsetConfig, "appimage">>): void { | CODE |
| LOW | test/src/updater/blackboxUpdateHelpers.ts | 188 | async function handleInitialInstallPerOS({ | CODE |
| LOW | test/src/updater/blackboxUpdateLinuxSuite.ts | 8 | export function registerBlackboxLinuxTests(toolset: Required<Pick<ToolsetConfig, "appimage">>): void { | CODE |
| LOW | test/src/updater/blackboxUpdateLinuxSuite.ts | 35 | export function registerBlackboxLinuxPackageManagerTests(): void { | CODE |
| LOW | test/src/updater/differentialUpdateWinSuite.ts | 12 | export function registerDifferentialWinTests(toolsets: ToolsetConfig): void { | CODE |
| LOW | test/src/mac/macArchiveTest.ts | 25 | function createMacFrameworkSymlinkTest(expect: ExpectStatic, format: "zip" | "7z") { | CODE |
| LOW | test/src/linux/linuxPackagerTestSuite.ts | 19 | export function registerLinuxPackagerTests(toolsets: ToolsetConfig): void { | CODE |
| LOW | test/src/windows/winCodeSignTest.ts | 28 | function makeSignQueueTestPackager(signIfResults: SignIfResult[]) { | CODE |
| LOW | test/src/windows/winCodeSignTest.ts | 50 | function makeSequentialSignTestPackager() { | CODE |
| LOW | test/src/windows/squirrelWindowsTestSuite.ts | 7 | export function registerSquirrelWindowsTests(toolsets: ToolsetConfig): void { | CODE |
| LOW | test/src/windows/assistedInstallerTestSuite.ts | 10 | export function registerAssistedInstallerTests(toolsets: ToolsetConfig): void { | CODE |
| LOW | test/src/helpers/selfSignedIdentity.ts | 40 | export async function createSelfSignedCodeSigningIdentity(commonName: string, tmpDir: TmpDir, options: SelfSignedIdentit | CODE |
| LOW | test/src/helpers/launchAppCrossPlatform.ts | 484 | export async function deliverAndInstallSnapInVm(vm: VmManager, snapPath: string, opts: VmSnapOptions): Promise<{ version | CODE |
| LOW | test/src/helpers/launchAppCrossPlatform.ts | 572 | export async function installAndLaunchSnapLocally(snapPath: string, opts: VmSnapOptions): Promise<{ version: string }> { | CODE |
| LOW | test/src/helpers/downloadElectron.ts | 41 | export function downloadAllRequiredElectronVersions(): Promise<any> { | CODE |
| LOW | test/src/helpers/packTester.ts | 44 | export function getPackageManagerWithVersion(pm: PM, packageManagerAndVersionString?: string) { | CODE |
| LOW | test/src/helpers/packTester.ts | 76 | function getLockfileFixtureNameCandidates(currentTestName: string): Array<string> { | CODE |
| LOW | test/src/helpers/packTester.ts | 841 | export async function getWindowsSigningIdentity(): Promise<SelfSignedIdentity> { | CODE |
| LOW | test/src/helpers/providerTestUtil.ts | 38 | export function assertDownloadNotTriggered(expect: ExpectStatic, result: any, actualEvents: string[]): void { | CODE |
| LOW | packages/electron-updater/src/providerFactory.ts | 23 | export function isUrlProbablySupportMultiRangeRequests(url: string): boolean { | CODE |
| LOW | …ater/src/differentialDownloader/downloadPlanBuilder.ts | 93 | function validateAndAdd(operation: Operation, operations: Array<Operation>, checksum: string, index: number): void { | CODE |
| LOW | …/src/differentialDownloader/multipleRangeDownloader.ts | 8 | export function executeTasksUsingMultipleRangeRequests( | CODE |
| LOW | packages/app-builder-lib/src/platformPackager.ts | 992 | export function computeSafeArtifactNameIfNeeded(suggestedName: string | null, safeNameProducer: () => string): string | | CODE |
| LOW | packages/app-builder-lib/src/fileMatcher.ts | 151 | export function collectExplicitReincludes(patterns: ReadonlyArray<string>): { extensions: Set<string>; names: Set<string | CODE |
| LOW | packages/app-builder-lib/src/fileMatcher.ts | 177 | export function getDefaultIgnoredPatterns(userPatterns: ReadonlyArray<string>, includePdb: boolean): Array<string> { | CODE |
| LOW | packages/app-builder-lib/src/fileMatcher.ts | 214 | export function getReincludedDefaultExclusions(patterns: ReadonlyArray<string>): Array<string> { | CODE |
| LOW | packages/app-builder-lib/src/options/winOptions.ts | 419 | export function resolveWindowsSigningConfiguration(config: WindowsConfiguration): WindowsSigningConfiguration | null { | CODE |
| LOW | …lib/src/options/CommonWindowsInstallerConfiguration.ts | 85 | function convertToDesktopShortcutCreationPolicy(value: boolean | undefined | string): DesktopShortcutCreationPolicy { | CODE |
| LOW | …uilder-lib/src/node-module-collector/packageManager.ts | 88 | function detectPackageManagerByEnv(): PM | null { | CODE |
| LOW | …uilder-lib/src/node-module-collector/packageManager.ts | 102 | async function detectPackageManagerByFile(dir: string): Promise<PM | null> { | CODE |
| LOW | …ges/app-builder-lib/src/node-module-collector/index.ts | 17 | export function getCollectorByPackageManager(pm: PM, rootDir: string, tempDirManager: TmpDir) { | CODE |
| LOW | …ges/app-builder-lib/src/node-module-collector/index.ts | 113 | async function findNearestPackageJsonWithWorkspacesField(dir: string): Promise<string | undefined> { | CODE |
| LOW | packages/app-builder-lib/src/util/appFileCopier.ts | 145 | function getNodeModuleExcludedExts(platformPackager: PlatformPackager<any>) { | CODE |
| LOW | packages/app-builder-lib/src/util/appFileCopier.ts | 167 | export async function computeNodeModuleFileSets( | CODE |
| LOW | packages/app-builder-lib/src/util/appFileCopier.ts | 229 | export function collectionMatchesAppDependencies(nodeModules: NodeModuleInfo[], dependencies: Record<string, string> | u | CODE |
| LOW | packages/app-builder-lib/src/util/appFileCopier.ts | 247 | export async function resolveFirstMatchingCollection(options: { | CODE |
| LOW | packages/app-builder-lib/src/util/appFileCopier.ts | 275 | async function collectNodeModulesWithLogging(platformPackager: PlatformPackager<any>, arch: Arch | null) { | CODE |
| LOW | packages/app-builder-lib/src/util/license.ts | 30 | export async function getNotLocalizedLicenseFile( | CODE |
| LOW | packages/app-builder-lib/src/util/streamSpawnToFile.ts | 117 | export function buildPowerShellEncodedArgs(command: string, args: string[]): string[] { | CODE |
| LOW | packages/app-builder-lib/src/util/electronGet.ts | 81 | export async function getCacheDirectoryInternal(options: { isAvoidSystemOnWindows?: boolean; allowEnvVarOverride: boolea | CODE |
| LOW | packages/app-builder-lib/src/util/electronGet.ts | 641 | function buildElectronArtifactConfig(artifactOptions: ArtifactDownloadOptions): ElectronPlatformArtifactDetails { | CODE |
| LOW | packages/app-builder-lib/src/util/electronGet.ts | 659 | export function downloadElectronArtifactZip(options: ArtifactDownloadOptions): Promise<string> { | CODE |
| LOW⚡ | packages/app-builder-lib/src/util/flags.ts | 5 | export function isAutoDiscoveryCodeSignIdentity() { | CODE |
| LOW⚡ | packages/app-builder-lib/src/util/flags.ts | 19 | export function isRemoveStageDirEvenIfDebug() { | CODE |
| LOW⚡ | packages/app-builder-lib/src/util/flags.ts | 35 | export function isElectronBuilderAllowedAsProductionDependency() { | CODE |
| LOW | …kages/app-builder-lib/src/util/normalizePackageData.ts | 187 | function fixBundleDependenciesField(data: any) { | CODE |
| LOW | packages/app-builder-lib/src/util/archCompatibility.ts | 97 | export async function collectSingleArchPackageNames(nodeModulesDir: string, names: Set<string> = new Set<string>()): Pro | CODE |
| LOW | packages/app-builder-lib/src/util/archCompatibility.ts | 189 | export async function collectIdenticalSingleArchMachOFiles(unpackedDirA: string, unpackedDirB: string): Promise<string[] | CODE |
| LOW | packages/app-builder-lib/src/util/archCompatibility.ts | 208 | export function buildSingleArchFilesPattern(patterns: Iterable<string>, userPattern: string | undefined): string | undef | CODE |
| LOW | packages/app-builder-lib/src/util/config/config.ts | 41 | export function createProjectMetadataLazy(projectDir: string): Lazy<Record<string, any> | null> { | CODE |
| LOW | packages/app-builder-lib/src/util/config/config.ts | 98 | async function loadParentConfigsRecursively(configExtends: Configuration["extends"], loader: (configExtend: string) => P | CODE |
| LOW | packages/app-builder-lib/src/util/config/config.ts | 256 | export async function computeDefaultAppDirectory(projectDir: string, userAppDir: string | Nullish): Promise<string> { | CODE |
| LOW | packages/app-builder-lib/src/util/win/resEdit.ts | 53 | function patchManifestExecutionLevel(res: NtExecutableResource, level: string, file: string): void { | CODE |
| LOW | …ages/app-builder-lib/src/util/mac/macosIconComposer.ts | 53 | export async function generateAssetCatalogForIcon(tmpDir: TmpDir, inputPath: string): Promise<AssetCatalogResult> { | CODE |
| LOW | packages/app-builder-lib/src/util/mac/macosVersion.ts | 21 | async function isOsVersionGreaterThanOrEqualTo(input: string) { | CODE |
| LOW | …ilder-lib/src/targets/differentialUpdateInfoBuilder.ts | 11 | export function createNsisWebDifferentialUpdateInfo(artifactPath: string, packageFiles: { [arch: string]: PackageFileInf | CODE |
| 42 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | test/src/helpers/launchAppCrossPlatform.ts | 519 | elif [ -n "\$XVFB_BIN" ]; then | CODE |
| HIGH | …builder-lib/src/targets/linux/appimage/appImageUtil.ts | 335 | elif [ -x /usr/bin/kdialog ] ; then | CODE |
| HIGH | …builder-lib/src/targets/linux/appimage/appImageUtil.ts | 337 | elif [ -x /usr/bin/Xdialog ] ; then | CODE |
| HIGH | …builder-lib/src/targets/linux/appimage/appImageUtil.ts | 351 | elif [ -x /usr/bin/kdialog ] ; then | CODE |
| HIGH | …builder-lib/src/targets/linux/appimage/appImageUtil.ts | 353 | elif [ -x /usr/bin/Xdialog ] ; then | CODE |
| HIGH | …builder-lib/src/targets/linux/appimage/appImageUtil.ts | 386 | elif [ -x /usr/bin/Xdialog ] ; then | CODE |
| HIGH | …builder-lib/src/targets/linux/appimage/appImageUtil.ts | 389 | elif [ -x /usr/bin/kdialog ] ; then | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | MIGRATION.md | 15 | ### Step 0: run the automated migrator | COMMENT |
| LOW | test/src/updater/blackboxWebInstallerTest.ts | 71 | // Step 1: Start the HTTP server first so we know the port before building. | COMMENT |
| LOW | test/src/updater/blackboxWebInstallerTest.ts | 88 | // Step 2: Build the nsis-web installer with the server URL baked in. | COMMENT |
| LOW | test/src/updater/blackboxWebInstallerTest.ts | 153 | // Step 3: Copy the .nsis.7z app package into the HTTP server root so the | COMMENT |
| LOW | website/docs/migration/v26-to-v27.md | 27 | ## Step 1: Run the automated migrator | COMMENT |
| LOW | website/docs/migration/v26-to-v27.md | 84 | ## Step 2: Update Node.js | COMMENT |
| LOW | website/docs/migration/v26-to-v27.md | 134 | ## Step 3: Apply the manual steps | COMMENT |
| LOW⚡ | packages/app-builder-lib/src/codeSign/certInfo.ts | 249 | // Step 1: D = ID byte repeated v times | COMMENT |
| LOW⚡ | packages/app-builder-lib/src/codeSign/certInfo.ts | 252 | // Step 2: S = salt bytes repeated to fill ceil(salt.length / v) * v bytes | COMMENT |
| LOW⚡ | packages/app-builder-lib/src/codeSign/certInfo.ts | 259 | // Step 3: P = password bytes repeated to fill ceil(password.length / v) * v bytes | COMMENT |
| LOW⚡ | packages/app-builder-lib/src/codeSign/certInfo.ts | 266 | // Step 4: I = S || P (mutable, updated in step 6C) | COMMENT |
| LOW | packages/app-builder-lib/src/codeSign/certInfo.ts | 391 | // Step 1: Verify MAC (or signature) integrity and parse the AuthenticatedSafe container. | COMMENT |
| LOW | packages/app-builder-lib/src/codeSign/certInfo.ts | 410 | // Step 2: Iterate over the authenticated-safe ContentInfos and extract all certificates. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/vitest-scripts/vitest-config/vitest-tmpdir.ts | 1 | import { afterEach, beforeEach } from "vitest" | COMMENT |
| LOW | test/src/HoistTest.ts | 81 | // it(`should support simple cyclic peer dependencies`, () => { | COMMENT |
| LOW | test/src/HoistTest.ts | 101 | COMMENT | |
| LOW | test/src/HoistTest.ts | 121 | } | COMMENT |
| LOW | test/src/HoistTest.ts | 261 | // . -> A -> B | COMMENT |
| LOW | test/src/HoistTest.ts | 381 | // -> F -> G -> B@X -> C@X -> D@X | COMMENT |
| LOW | test/src/HoistTest.ts | 421 | "B@X#1": { dependencies: [`C@Y`], peerNames: [`C`] }, | COMMENT |
| LOW | test/src/HoistTest.ts | 521 | // -> B@X | COMMENT |
| LOW | test/src/blockmapTest.ts | 181 | COMMENT | |
| LOW | test/src/asarIntegrityTest.ts | 1 | import { Platform } from "app-builder-lib" | COMMENT |
| LOW | test/src/updater/test-specific-platforms.sh | 1 | #!/bin/bash | COMMENT |
| LOW | test/src/updater/blackboxWebInstallerTest.ts | 21 | // 1. Build a nsis-web installer (the small stub .exe) and its companion | COMMENT |
| LOW | test/src/updater/blackboxUpdateWinSuite.ts | 121 | // elevation that most CI runners cannot provide reliably without a pre-elevated session. | COMMENT |
| LOW | test/src/linux/test-snap.sh | 1 | #!/bin/bash | COMMENT |
| LOW | test/src/linux/test-snap.sh | 21 | # | COMMENT |
| LOW | test/src/linux/test-snap.sh | 61 | export TEST_FILES="${TEST_FILES:-snapTest,snapHeavyTest}" | COMMENT |
| LOW | …-updater/src/windowsExecutableCodeSignatureVerifier.ts | 21 | COMMENT | |
| LOW | …/src/node-module-collector/pnpmNodeModulesCollector.ts | 141 | // Phase 1: find a version that SATISFIES requiredRange, trying the dep's own location | COMMENT |
| LOW | packages/app-builder-lib/src/util/electronGet.ts | 441 | } | COMMENT |
| LOW | packages/app-builder-lib/src/util/toolsetLock.ts | 41 | // invocation reserves a large `WebAssembly.Memory`. A single build converting one icon is fine, but | COMMENT |
| LOW | …kages/app-builder-lib/src/targets/blockmap/blockmap.ts | 1 | import { createHash } from "crypto" | COMMENT |
| LOW | packages/builder-util-runtime/src/uuid.ts | 221 | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | packages/app-builder-lib/scheme.json | 2311 | "description": "A [glob patterns](https://www.electron.build/file-patterns) relative to the [app directory](ht | CODE |
| MEDIUM | packages/app-builder-lib/scheme.json | 2955 | "description": "A [glob patterns](https://www.electron.build/file-patterns) relative to the [app directory](ht | CODE |
| MEDIUM | packages/app-builder-lib/scheme.json | 3433 | "description": "A [glob patterns](https://www.electron.build/file-patterns) relative to the [app directory](ht | CODE |
| LOW | packages/app-builder-lib/scheme.json | 4398 | "description": "The path to EULA license file. Defaults to `license.txt` or `eula.txt` (or uppercase variants) | CODE |
| LOW | packages/app-builder-lib/scheme.json | 4751 | "description": "The path to EULA license file. Defaults to `license.txt` or `eula.txt` (or uppercase variants) | CODE |
| LOW | packages/app-builder-lib/scheme.json | 5747 | "description": "The path to EULA license file. Defaults to `license.txt` or `eula.txt` (or uppercase variants) | CODE |
| MEDIUM | packages/app-builder-lib/scheme.json | 8406 | "description": "A [glob patterns](https://www.electron.build/file-patterns) relative to the [app directory](ht | CODE |
| MEDIUM | packages/app-builder-lib/scheme.json | 9414 | "description": "A [glob patterns](https://www.electron.build/file-patterns) relative to the [app directory](https: | CODE |
| LOW | packages/app-builder-lib/src/options/pkgOptions.ts | 66 | * The path to EULA license file. Defaults to `license.txt` or `eula.txt` (or uppercase variants). In addition to `txt | COMMENT |
| MEDIUM | …uilder-lib/src/options/PlatformSpecificBuildOptions.ts | 112 | You can use [file macros](https://www.electron.build/file-patterns#file-macros) in the `from` and `to` fields as well. ` | CODE |
| LOW | …es/app-builder-lib/src/targets/win/nsis/nsisOptions.ts | 189 | * The path to EULA license file. Defaults to `license.txt` or `eula.txt` (or uppercase variants). In addition to `txt | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/src/updater/blackboxWebInstallerTest.ts | 71 | // Step 1: Start the HTTP server first so we know the port before building. | COMMENT |
| LOW | test/src/updater/blackboxWebInstallerTest.ts | 88 | // Step 2: Build the nsis-web installer with the server URL baked in. | COMMENT |
| LOW | test/src/updater/blackboxWebInstallerTest.ts | 153 | // Step 3: Copy the .nsis.7z app package into the HTTP server root so the | COMMENT |
| LOW⚡ | packages/app-builder-lib/src/codeSign/certInfo.ts | 249 | // Step 1: D = ID byte repeated v times | COMMENT |
| LOW⚡ | packages/app-builder-lib/src/codeSign/certInfo.ts | 252 | // Step 2: S = salt bytes repeated to fill ceil(salt.length / v) * v bytes | COMMENT |
| LOW⚡ | packages/app-builder-lib/src/codeSign/certInfo.ts | 259 | // Step 3: P = password bytes repeated to fill ceil(password.length / v) * v bytes | COMMENT |
| LOW⚡ | packages/app-builder-lib/src/codeSign/certInfo.ts | 266 | // Step 4: I = S || P (mutable, updated in step 6C) | COMMENT |
| LOW | packages/app-builder-lib/src/codeSign/certInfo.ts | 391 | // Step 1: Verify MAC (or signature) integrity and parse the AuthenticatedSafe container. | COMMENT |
| LOW | packages/app-builder-lib/src/codeSign/certInfo.ts | 410 | // Step 2: Iterate over the authenticated-safe ContentInfos and extract all certificates. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/src/concurrentBuildsTest.ts | 156 | // Regression test for #9852: elevate.exe must reach the dir-target output (win-unpacked/resources) | COMMENT |
| MEDIUM | test/src/helpers/archiveHelper.ts | 5 | // listing (`-slt`), which prints one `Path = <entry>` line per entry — robust against entry names | COMMENT |
| MEDIUM | packages/app-builder-lib/scheme.json | 454 | "description": "Bitbucket options.\nhttps://bitbucket.org/\nDefine `BITBUCKET_TOKEN` environment variable.\n\nFor | CODE |
| MEDIUM | …/src/node-module-collector/yarnNodeModulesCollector.ts | 6 | // Instead of parsing Yarn's custom NDJSON output, we leverage npm's list command | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/src/linux/test-snap.sh | 132 | # Set SNAP_CORE to test a single core (ideal for CI matrix jobs). | COMMENT |
| LOW | …kages/app-builder-lib/templates/snap/desktop-common.sh | 124 | # Set XDG_DATA_HOME to local path | COMMENT |
| LOW | …kages/app-builder-lib/templates/snap/desktop-common.sh | 189 | # Check if we can actually read the contents of each xdg dir | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/src/cliTest.ts | 212 | expect(quoteString("Acme Corp")).toBe("Acme Corp") | CODE |
| LOW | website/docs/features/build-lifecycle.md | 301 | xml = xml.replace('Manufacturer="PLACEHOLDER"', 'Manufacturer="Acme Corp"') | CODE |